A live quality-checking guide for CodexBar, a menu-bar app that shows usage from AI service providers. It covers provider checks, real app configuration, menu verification, and safe handling of credentials.

Running provider usage checks, testing release builds, confirming menu behavior, checking current provider APIs, and investigating reports that a provider works or fails.

It helps distinguish a real provider or app problem from a test that only works with mock data or the wrong executable.

qa-test — Skill by steipete

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/steipete/codexbar/qa-test

Any agent

npx skills add steipete/CodexBar --skill qa-test

Clone the repo

git clone --depth 1 https://github.com/steipete/CodexBar

Made for: Claude Code, Codex.

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,232 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00055	$0.01232
Opus 5	$0.00028	$0.00616
Sonnet 5	$0.00011	$0.00246
Haiku 4.5	$0.00006	$0.00123

Measured 2d ago against content hash 4265af12c0cf, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

qa-test scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/live_provider_matrix.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

chmod 600 "$HOME/.codexbar"/config.pre-qa-*.json

.agents/skills/qa-test/SKILL.md · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CodexBar Live QA

Use for live provider testing, release smoke tests, menu verification, or debugging “provider works/fails” reports.

Rules

Work from the CodexBar repo checkout.
Use the packaged CLI first: CodexBar.app/Contents/Helpers/CodexBarCLI.
Do not use CodexBar.app/Contents/MacOS/codexbar; that is the app binary and may appear to hang as a CLI.
Never run broad env, set, or secret regex dumps.
Use $one-password for secrets: all op commands inside one persistent tmux session, service account first, no raw secret output.
Treat browser-cookie/keychain flows as prompt-risky. Prefer CLI/API-token checks and KeychainNoUIQuery-safe tests unless the user explicitly requested live UI.
For current API behavior, browse official provider docs only.

CLI Matrix

Run the bundled script:

.agents/skills/qa-test/scripts/live_provider_matrix.sh --enabled

Useful modes:

.agents/skills/qa-test/scripts/live_provider_matrix.sh --provider all
.agents/skills/qa-test/scripts/live_provider_matrix.sh --providers openai,zai,deepseek
.agents/skills/qa-test/scripts/live_provider_matrix.sh --default

Interpretation:

--enabled asks CodexBarCLI config providers for enabled providers, honoring CODEXBAR_CONFIG and default toggles.
--default runs the app-facing default command with no provider override.
--provider all forces every registered provider and is expected to fail for providers without sessions/keys.
A green app config needs --enabled and --default clean; --provider all is a discovery/triage tool.

Config QA

Validate config:

CodexBar.app/Contents/Helpers/CodexBarCLI config validate
stat -f '%Lp %N' "$HOME/.codexbar/config.json"

Redact config shape:

jq '(.providers // []) |= map(.apiKey = (if .apiKey then "<redacted>" else .apiKey end) |
  .secretKey = (if .secretKey then "<redacted>" else .secretKey end) |
  .cookieHeader = (if .cookieHeader then "<redacted>" else .cookieHeader end) |
  (if .id == "stepfun" and has("region") then .region = "<redacted>" else . end) |
  .tokenAccounts = (if .tokenAccounts then (.tokenAccounts | .accounts = (.accounts | map(.token = "<redacted>"))) else .tokenAccounts end))' \
  "$HOME/.codexbar/config.json"

Read the full file on GitHub · 119 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 119 lines · 55 tokens per session scan B 4265af12c0cf

Subscribe to this mod's changes

qa-test is a skill published in the GitHub repository steipete/CodexBar (20,730 stars, last pushed 3d ago), licensed MIT. It adds 55 tokens to every session and 1,232 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

E2E testing Testing ai claude-code codex swift

fix-integration-failures

Diagnose and fix a failing scheduled (or standalone) TMDb Integration workflow run — re-run transients, or fix real drift on a branch off main, then PR and (optionally) merge. Use for the weekly Sunday Integration cron failure, or any red Integration run not tied to an open PR.

adamayoung/TMDb · 69 tokens

verify

Drive CrowTelemetry's OTLP ingest end-to-end — boot the real receiver, POST OTLP JSON with curl, inspect the SQLite db.

corveil/crow · 30 tokens

build-and-verify

Build, test, and end-to-end verify the Multiplex visionOS/iPadOS SSH-tmux terminal app. Use this whenever you need to compile the app, run its unit tests, regenerate the Xcode project after editing project.yml or adding/ removing source files, or confirm a change works in the real app on the visionOS or iPad…

multiplex-term/Multiplex · 176 tokens

xcforge

Complete reference for xcforge — 109 MCP tools + 113 CLI commands for iOS development. Covers build, test, simulator, physical devices, SPM, UI automation, screenshots, logs, git, visual regression, accessibility, localization, session profiles, diagnosis workflows, plan execution, LLDB debugger integration, bless…

justinthevoid/xcforge · 130 tokens

agent-host-e2e-tests

Use when writing, recording, updating, or troubleshooting the agent host end-to-end tests under src/vs/platform/agentHost/test/node/e2e (black-box tests that drive the whole agent host over the AHP protocol, using a CapiReplayProxy record/replay system for Claude/Copilot/Codex). Covers adding a cross-provider test…

microsoft/vscode · 104 tokens

use-agent-browser-for-airi

Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…

moeru-ai/airi · 87 tokens

qa-test